Convex Audit
- 5 installs
- 5 repo stars
- Updated August 5, 2026
- bjornmelin/dev-skills
convex-audit is a skill that audits a Convex-backed codebase for schema, security, runtime-boundary, and migration risks.
About
convex-audit performs read-first audits of a Convex-backed codebase, covering schema quality, security, runtime boundaries, migrations, and function-surface risks. A developer uses it for a Convex review, backend audit, or remediation plan on existing architecture. It runs convex-scan inventory, surface, and gaps, then outputs ranked findings and an implementation-ready remediation checklist.
- Read-first audit of a Convex-backed codebase for schema, security, runtime boundaries, and migrations
- Runs convex-scan inventory, surface, and gaps to ground findings before recommendations
- Outputs ranked findings and an implementation-ready remediation checklist with file targets and risk levels
Convex Audit by the numbers
- 5 all-time installs (skills.sh)
- Ranked #881 of 1,352 Code Review & Quality skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
convex-audit capabilities & compatibility
- Capabilities
- convex audit · backend audit · security review · schema review
- Use cases
- security audit · code review · database
What convex-audit says it does
Use this skill for read-first Convex audits that produce a clear remediation plan before implementation.
Audit a Convex-backed codebase for schema quality, security, runtime boundaries, migrations, and function-surface risks.
Output a remediation plan with file targets, risk level, and verification steps.
npx skills add https://github.com/bjornmelin/dev-skills --skill convex-auditAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 5 |
|---|---|
| repo stars | ★ 5 |
| Last updated | August 5, 2026 |
| Repository | bjornmelin/dev-skills ↗ |
What it does
Audit an existing Convex backend for schema, security, and runtime risks and produce a remediation plan.
Who is it for?
Reviewing an existing Convex backend and producing a ranked remediation plan.
Skip if: Green-field feature-spec generation, which is handled by convex-feature-spec.
When should I use this skill?
The user asks for a Convex review, backend audit, contract analysis, or remediation plan on an existing implementation.
What you get
A concise audit summary, ranked findings, and an implementation-ready remediation checklist.
- audit summary
- ranked findings
- remediation checklist with file targets and risk levels
By the numbers
- 7-step audit workflow
- 4 domain references (security, schema, runtime-boundaries, migrations)
Files
Convex Audit
Use this skill for read-first Convex audits that produce a clear remediation plan before implementation.
Workflow
1. Read the repo AGENTS.md. 2. Run /home/bjorn/.codex/skill-support/bin/convex-scan inventory --cwd <repo> --out <json>. 3. Run /home/bjorn/.codex/skill-support/bin/convex-scan surface --cwd <repo> --out <json>. 4. Run /home/bjorn/.codex/skill-support/bin/convex-scan gaps --inventory <json> --out <json>. 5. Read only the references needed for the active findings:
references/security.mdreferences/schema.mdreferences/runtime-boundaries.mdreferences/migrations.md
6. Validate non-trivial recommendations against current docs before finalizing. 7. Output a remediation plan with file targets, risk level, and verification steps.
Use When
- The user asks for a Convex audit, security pass, schema review, or backend remediation plan.
- The repo has Convex and the main task is to assess existing architecture or implementation quality.
Do Not Use When
- The task is a new feature specification with multiple design options.
- The task is only a dependency upgrade or docs sync.
Outputs
- A concise audit summary.
- Ranked findings.
- An implementation-ready remediation checklist.
Resources
- Inventory helpers via
/home/bjorn/.codex/skill-support/bin/convex-scan references/security.mdreferences/schema.mdreferences/runtime-boundaries.mdreferences/migrations.md
interface:
display_name: "Convex Audit"
short_description: "Audit Convex schemas, security, functions, and migrations"
default_prompt: "Use $convex-audit to inventory the Convex surface, identify risks, and produce a remediation plan with repo-native verification."
policy:
allow_implicit_invocation: true
dependencies:
tools:
- type: "mcp"
value: "context7"
description: "Current library documentation"
- type: "mcp"
value: "exa"
description: "Supplemental current research when needed"
Migrations
Audit migration safety by checking:
1. ordering of schema and code changes 2. backfill requirements 3. rollout and rollback safety 4. assumptions about live data shape
If the repo appears green-field, still call out destructive assumptions explicitly.
Runtime Boundaries
Review whether each function is correctly placed as:
querymutationactionhttpAction- internal variants
Watch for unnecessary node-runtime use, public overexposure, and missing return-shape discipline.
Convex Schema
Review:
1. schema completeness and naming 2. optional vs nullable consistency 3. index/query alignment 4. search index and filter coverage where relevant
Prefer one canonical schema path; avoid duplicated or parallel table contracts.
Convex Security
Prioritize:
1. authn/authz boundaries 2. public vs internal function exposure 3. validator coverage at every external boundary 4. sensitive operations and secret handling
Treat missing or weak validators as real audit findings unless the repo has a documented exception.
#!/usr/bin/env python3
from __future__ import annotations
import argparse
import subprocess
from pathlib import Path
def main() -> int:
parser = argparse.ArgumentParser(description="Wrapper around the shared convex-scan inventory command.")
parser.add_argument("--cwd", default=".")
parser.add_argument("--out", required=True)
args = parser.parse_args()
cmd = [
"/home/bjorn/.codex/skill-support/bin/convex-scan",
"inventory",
"--cwd",
str(Path(args.cwd).resolve()),
"--out",
args.out,
]
return subprocess.run(cmd, check=False).returncode
if __name__ == "__main__":
raise SystemExit(main())
Related skills
Improve Codebase ArchitectureSafely deepen clusters of shallow modules into cohesive, testable units while respecting their external dependencies.566k196k
Caveman ReviewGet ultra-compressed, one-line code review comments that cut noise while keeping every actionable fix.270k94.7kCodebase DesignShared vocabulary for designing deep modules: improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable.266k196kCavecrewDelegate coding tasks to specialized subagents that return compressed output, keeping the main context window usable for much longer sessions.220k94.7kCode ReviewReviews a branch or PR diff on two axes at once: conformance to coding standards plus a code-smell baseline, and whether it actually implements the original spec.201k196k
Requesting Code ReviewDispatch a consistent, high-signal code reviewer subagent that catches plan deviations and quality issues before merging or continuing development.183k264kFAQ
When should I not use it?
When the task is a new feature specification with design options; use convex-feature-spec instead.
What does it output?
A concise audit summary, ranked findings, and an implementation-ready remediation checklist.